net8.0-windows.zip
- SHA256 8b8d226feef2145f5ffdba54166c0302218a6736d78a11036ff8938a3be5b8c2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
net8.0-windows/PlooshLauncher.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
120 seconds
General
- Target net8.0-windows.zip
- Size 363.1MB
- Sample260925-svkkvsfb84
- SHA256 8b8d226feef2145f5ffdba54166c0302218a6736d78a11036ff8938a3be5b8c2
- MD5 c82caad7deb6878c6cead8607768d412
- SHA1 09049d9297fe17d5071d2ae7736eeec225e79bfb
- SHA512 976189c69ed20466adbb524426c17a62eaa3ad6b21a5be7b2d02ca702d4778f89374d0ff307dc318c5aec83d022d768316d755ec980de081c9bfe86aec98cbe5
- SSDEEP 6291456:co9oyC5ivUe7gpkKi1kO6DYqp6GAYG9ZQ7WEBiu3bGBVH1CTQlowx0JXCc7qAgd6:c/+U0gpPiSO6DYar1R7WEMlVVCTCKlCq
- TLSH T15D0933EEDAB460B831EA5A01A14C953DB34B3BD491F37DC7AC411B55B26B927C12CC8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/net8.0-windows/PlooshLauncher.dll unpack001/net8.0-windows/PlooshLauncher.exe unpack001/net8.0-windows/Wpf.Ui.dll
File Explorer
-
net8.0-windows.zip.zip 363.1MB
-
net8.0-windows/PlooshLauncher.deps.json992B
-
net8.0-windows/PlooshLauncher.dll.exe 37KB
-
net8.0-windows/PlooshLauncher.dll.config1KB
-
net8.0-windows/PlooshLauncher.exe.exe 148KB
-
net8.0-windows/PlooshLauncher.pdb15KB
-
net8.0-windows/PlooshLauncher.runtimeconfig.json429B
-
net8.0-windows/Wpf.Ui.dll.dll 5.2MB
-
net8.0-windows/pakchunkTozo-WindowsClient.pak358.1MB
-
net8.0-windows/pakchunkTozo-WindowsClient.sig26KB
-
net8.0-windows/z_BubbleBuilds_P.pak5.4MB
-
net8.0-windows/z_BubbleBuilds_P.sig256KB
net8.0-windows/PlooshLauncher.deps.json
- SHA256 d425b26b667bf14886e32a116ddee10bb5b3a8d8be55a56b6124688ff6105b7e
- MD5 b253ec0fc619683f3210f04ec8c604b3
- SHA1 e3bf24568d6ce9149e1b51505e38000acecb8809
- SHA512 712583eb08a30089fbe35f42c999f4603ca9cca615d88278bee8d8768212f358952b054b29a14696becf803fc53545c9861eaedfc9fdc7d49f4facf38f8c61ba
- TLSH T15D114454D5A00EAB06F12BB6943B4746FB32D77B1008180A7CBE544C4F7BD1BA450E79
- MD5 SHA1 SHA512 TLSH
net8.0-windows/PlooshLauncher.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2f191fb61c7cc1615435feb9c27edc7a94fabd5270618b1cbf5dcf88f884a286
- MD5 1d6f204a64e57448a63ee4c3781d73ed
- SHA1 58701378a43d54b68be7aefffb26f29b71ab4f9e
- SHA512 1a2675fa2556f8f38f79cec99a464d563ffd4350990af51e18d372d3cb730ee384213d8ecb330bb599e18a880167da8ee3189df32f125382f95d37ab099005c6
- SSDEEP 384:/wi2GekZeMoxuaozNFLoQEdH1z4QMM3voxM1t3ttbEt+GwkM99grAI73LcMdh7e9:4sek2ICgD21ftbM+d2AIjLqTM
- TLSH T139036D14B3EC026ADAB7837988B146414BB1F6116712CBEF05D4614E4E73BC25F327B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\tikto\Desktop\DiamondV2LAUNCHER'\obj\Release\net8.0-windows\PlooshLauncher.pdb
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/PlooshLauncher.dll.config
- SHA256 7619bc7bd6d38d62312f3e81ae3a4871dbacbc0865df2e98166ab4d872b0f5be
- MD5 8940bdfbebd41bb4c1ea77ac7f79a139
- SHA1 9fbb406da0fa9fb907b113199781eb04e78d2230
- SHA512 b36569a8e223e17a63cf31d4da82881006c6211a7efd24e1eccfd10d54659f830f4b0ea549cc795214bdc39011db1974b33a21f2b1db8baeee28f27eab776459
- TLSH T1D611294031E5EE6F41033E32D63093484FB142AB537564A8F8BC76A89F258CA4B573AD
- MD5 SHA1 SHA512 TLSH
net8.0-windows/PlooshLauncher.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 29f1769e2d4f76fe9a56e785b2a91da4692310817ef5aa4b1fd0dca3b98152f2
- MD5 2cb96a7514ddc9c7093f3f771c172285
- SHA1 7a7690a2ac783e32ea21f98fbd211b56836bfd56
- SHA512 f1952ffcb4d515caa69b979eb9a78c60ab2b2ddd0fa6fb80dbe07e1a09fb25734e4d8049ea46768f8fefc51d146d915cae5f2fa39d76db525ac2135660e67425
- SSDEEP 3072:/qeXA/4yIbHkNPN+6H6xCYOiVUE265dJ0:/vdHkNFdaxmVE9J
- TLSH T195E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35228,
count=1, id=258, version=35228,
net8.0-windows/PlooshLauncher.pdb
- SHA256 f350ba64e43f7c2d7c090e22c6323352d64816cfa3e1619acf783e60e96fd4e1
- MD5 c6bf0a44d4bea1e871dbc0d4371b7028
- SHA1 e198e59b9c5f75b07273c79fb7919f722ee726d6
- SHA512 751bcaede0720988f80d7ca44f10b10f581c43b86c961db3afe375527e19f3e35f3260c2d93684f3561249bdab95db0fbc4692d557485729843607f671044546
- SSDEEP 384:A7dKNlEae1cXazalqCjEqZ6FBMHcYCbuCVbZ4DudnCqSH5fcH+Nbola51c1+T:A7dS2IAaaVbWaal
- TLSH T10162A57BA35CD922C98205776932CA8C7730C3212741EE79F1D43A4DEDBF69A03B65A1
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/PlooshLauncher.runtimeconfig.json
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH
net8.0-windows/Wpf.Ui.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4823f55ff35c151ab5f7e3731b1902a78049c81050fc2a5bb8b51692184c406a
- MD5 cf889e7ec2c82b2b4512f139c27f4b3a
- SHA1 a3dce689e34136a8b445bf9cd8e4e76687a3afc3
- SHA512 3b0a15b6ae7c7fb6cf99e38a770ae3327ed2109b89dbdd304e8e53b0969eefec3bf329d9004f00a5bd745bde212374553e46dec376138b54ddaf5ddd1e7bea2d
- SSDEEP 98304:7kk1p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:/1HZNkq4p
- TLSH T141465C9E23ED0D37C36383798DA0733319A619251152AB875F4EDB2D847A0C5CEF269B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5466942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Wpf.Ui/obj/Release/net8.0-windows/Wpf.Ui.pdb
mscoree
_CorDllMain
Name
.text
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/pakchunkTozo-WindowsClient.pak
- SHA256 4aeb0e6699418db0fc4c66d3b3c324fe39881896d12cc29757a07dff68682190
- MD5 15b4e0259797ba84ec5292a803bed0c8
- SHA1 de2901b0a152140791987c2d2714377ed6d755f0
- SHA512 c29f173100a91f8d7413379fe3d0c29f2c14bf9f3c08ea1c64b824a10296051f95dddf397165a09a3bc9d0b83923c1af45c65edac56bbb6de0d8aa1518117117
- SSDEEP 6291456:xEFH9Hyg5+9SI6504xtIRExFqcngr/wjDqzHTq9YINGauSpr+JyVuco3yRCH+hWc:xmND+9SI62I2YV4IvEHTEBoauSpaJou4
- TLSH T15D09330FD666C400EA9B607A04B51F8025AD48CC82F49B77EBA95174BDC37B96E3B1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/pakchunkTozo-WindowsClient.sig
- SHA256 23c116bcf26c4f668bfb0b2665f05152c273be562891d419b61a7e91a83e3d11
- MD5 b5b252f1c98c24a0d06d338e4d5210b3
- SHA1 edf7fda5856881259d21157b3b9a4c52612c571c
- SHA512 6d4c804b4beda0ec20b841108e4bb06133b34979daacdf41d5bb2616cfe9dccb6b4ee1bba0ff066cf635b8dde6a1b0d56f80f701be39228937f00b3383f8a81b
- SSDEEP 768:n+dGYLHSue9euA/l6HdH/YUD1fHhTeMwe0bS:8LyuKWN6HNAgfWeD
- TLSH T18DC2D0CB4CB92B93CA84E9253099B2995FDBAF447410C5E49FF2F0A1292C4B49B68D49
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/z_BubbleBuilds_P.pak
- SHA256 25d1c5457b6dc2530af9e40ec9f73c73eec8d6a68e75c7de7384903733e4ff18
- MD5 4e01c733d85c9dcef7469be545d35c7b
- SHA1 8e1013aeee7ee867a81f41f97850c4d2ce8648a2
- SHA512 05c7ce3f4e08031ef6cffb27f06fb106fd9c6681060f05e77d146baf8f8a389b59016f0085e327e229ed50e8b5682095dc72c3924a7f71f498f7207be184476d
- SSDEEP 98304:Xaq/BClPA+n4KDOERM8uJl3Wc/y+A9XrDIAivCzyWcyj0H3cwTrIiUNmQ0tdhCRQ:Xaq/4LNyEW88lGcK+mDjlL0XVnINNmxb
- TLSH T10946336DF26C5560E49F8330393704688D527FACA273181D8C17E6AB01EADDA9E9CF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/z_BubbleBuilds_P.sig
- SHA256 1a97ca5a4531eb575e33cfea72cfb31c43430e1ac989afb9926630fd9026104b
- MD5 e8b213f7676a4b5fcf8cdeeefa5ab488
- SHA1 e38f833a9258c1143a14daf24ff4df7c45f07e9c
- SHA512 260f1e3d13b2f8579fe963304a522dce87856aafc212193ac98c442bfbd61d4aa7b69683f1124e92eb292aa6a61967618b29d3725ca53986d7b5c2aef516dc1a
- SSDEEP 6144:91Oxd3/eZbcxmxvUHw2RYPK4Qn5aDh5fN6Nad:jOn3GBcW2R0KPngDhNead
- TLSH T1C244125353A165E4C63E089A924102F103DF5D6BB7FB1F78AA3B9D8E79B9C37C158082
- MD5 SHA1 SHA512 SSDEEP TLSH